CVE-2013-2239
vzkernel before 042stab080.2 in the OpenVZ modification for the Linux kernel 2.6.32 does not...
CVE-2013-2239 is a medium vulnerability (CVSS 4.7) in Openvz Vzkernel, published September 27, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 29th percentile. No source names a fixed version.
- Severity
- 4.7 MediumCVSS 2.0, NVD
- Exploit chance
- 0.35%EPSS, 29th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
vzkernel before 042stab080.2 in the OpenVZ modification for the Linux kernel 2.6.32 does not initialize certain length variables, which allows local users to obtain sensitive information from kernel stack memory via (1) a crafted ploop driver ioctl call, related to the ploop_getdevice_ioc function in drivers/block/ploop/dev.c, or (2) a crafted quotactl system call, related to the compat_quotactl function in fs/quota/quota.c.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
linux-2.6Debian:6.0 From an advisory covering 11 CVEs | before 2.6.32-48squeeze4, plus listed versions 2.6.32-302.6.32-30+m68k.52.6.32-312.6.32-31~bpo50+12.6.32-32 Show 25 moreShow less2.6.32-332.6.32-342.6.32-34squeeze12.6.32-352.6.32-35squeeze12.6.32-35squeeze22.6.32-35~bpo50+12.6.32-362.6.32-372.6.32-382.6.32-392.6.32-39squeeze12.6.32-402.6.32-412.6.32-41squeeze22.6.32-422.6.32-432.6.32-442.6.32-452.6.32-462.6.32-46squeeze12.6.32-472.6.32-482.6.32-48squeeze12.6.32-48squeeze3 | 2.6.32-48squeeze4 |
What each source reports
NVD Score used
vzkernel before 042stab080.2 in the OpenVZ modification for the Linux kernel 2.6.32 does not initialize certain length variables, which allows local users to obtain sensitive information from kernel stack memory via (1) a crafted ploop driver ioctl call, related to the ploop_getdevice_ioc function in drivers/block/ploop/dev.c, or (2) a crafted quotactl system call, related to the compat_quotactl function in fs/quota/quota.c.
- Record
CVE-2013-2239- CVSS 2.0
- 4.7 Medium
AV:L/AC:M/Au:N/C:C/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
vzkernel before 042stab080.2 in the OpenVZ modification for the Linux kernel 2.6.32 does not initialize certain length variables, which allows local users to obtain sensitive information from kernel stack memory via (1) a crafted ploop driver ioctl call, related to the ploop_getdevice_ioc function in drivers/block/ploop/dev.c, or (2) a crafted quotactl system call, related to the compat_quotactl function in fs/quota/quota.c.
- Record
CVE-2013-2239- Updated
- 2026-11-02
EUVDEUVD-2013-2190No score
vzkernel before 042stab080.2 in the OpenVZ modification for the Linux kernel 2.6.32 does not initialize certain length variables, which allows local users to obtain sensitive information from kernel stack memory via (1) a crafted ploop driver ioctl call, related to the ploop_getdevice_ioc function in drivers/block/ploop/dev.c, or (2) a crafted quotactl system call, related to the compat_quotactl function in fs/quota/quota.c.
- Record
EUVD-2013-2190- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-46pj-qvxv-8vwgNo score
vzkernel before 042stab080.2 in the OpenVZ modification for the Linux kernel 2.6.32 does not...
vzkernel before 042stab080.2 in the OpenVZ modification for the Linux kernel 2.6.32 does not initialize certain length variables, which allows local users to obtain sensitive information from kernel stack memory via (1) a crafted ploop driver ioctl call, related to the ploop_getdevice_ioc function in drivers/block/ploop/dev.c, or (2) a crafted quotactl system call, related to the compat_quotactl function in fs/quota/quota.c.
- Record
GHSA-46pj-qvxv-8vwg- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
wiki.openvz.org/Download/kernel/rhel6-testing/042stab080.2
debian.org/security/2013/dsa-2766
bugs.gentoo.org/show_bug.cgi?id=475762
security-tracker.debian.org/tracker/CVE-2013-2239
openwall.com/lists/oss-security/2013/07/04/9
nvd.nist.gov/vuln/detail/CVE-2013-2239
github.com/advisories/GHSA-46pj-qvxv-8vwg